| Summary: | Unable to build on a host with FIPS mode enabled | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Mark Hatle <mark.hatle> |
| Component: | oe-core other | Assignee: | Mark Hatle <mark.hatle> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | minor | ||
| Priority: | Medium+ | CC: | randy.macleod |
| Version: | 3.2.5 | ||
| Target Milestone: | 4.1 M2 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | No (bug/feature does not impact docs) | |
|
Description
Mark Hatle
2021-10-21 20:16:35 UTC
I've done basic investigation of the issue (on gatesgarth / 3.2) and the cause seems to be based on two different items: 1) Host libraries/host tools * A number of native components use host libraries for basic functionality. These components would be restricted, by the FIPS enablement, from doing certain non-FIPS hash and cryptographic operations. * Some host system applications are disabled in FIPS mode, or have limits to various functionality. This MAY include md5sum, sha256sum, openssl, and even python modules. 2) Built (native) recipes that have cryptographic resources may check the host's FIPS enablement and act accordingly. The item #2 above is "easy" to fix, remove all of the checks in native components for host FIPS functionality. (But it will be like 'peeling an onion' as the checks are both compile and runtime. Item #1 the items need to be identified, and suitable "native" alternatives found. My original resource estimate was for one person it would take 2+ weeks of development, plus coordinating with the community, as well as additional time to generate appropriate test (host) configurations and create the tests. Mark, Is this also affecting master? Do you have anyone to work on it? I bricked my test system, so I've not been able to verify it on master. The key is that it's not just NSS, it's any host system cryptographic libraries, and some of the ones we build (native) when executed check the FIPS flag and go into a reduced functionality mode causing these types of failures. So I expect master (honister) is also broken. I had tried to fix this in gatesgarth and failed, since fixing one thing triggered then next and so on. I don't have any resources to work on it at this point, but I do intend to try to reproduce it on master for confirmation it's still an issue. I've tested this recently and other then a few recipes, everything appears to be working as of Kirkstone. Resolving. Fixes involved in this are: (yocto commit IDs) d895863af12e15bebd9fa0640290d9a649ece82b e9cc9772f277cbb270f52916b21d94abdaa1467f |